Section 1557 website accessibility penalties, explained

The first thing to know about Section 1557 website accessibility enforcement is that the number most write-ups quote does not exist. 45 CFR part 84 — the HHS rule implementing section 504 of the Rehabilitation Act, and the instrument that actually carries the web and mobile accessibility requirements — contains no civil monetary penalty, no per-violation amount and no schedule of fines. Its enforcement section, 45 CFR 84.98, is one sentence long: “The procedural provisions applicable to title VI of the Civil Rights Act of 1964 apply to this part. These procedures are found in 45 CFR 80.6 through 80.10 and 45 CFR part 81.”

That single cross-reference is the whole enforcement design, and it is worth following rather than paraphrasing, because it changes what a practice should actually be spending money on before 11 May 2027. A fine regime rewards paying the fine. A complaint-and-investigation regime rewards being able to show an investigator what you tested, when, and what you did about it.

Who can start it, and how long they have

Two routes open an enforcement matter, and only one of them involves a patient. 45 CFR 80.7(b) provides that “any person who believes himself or any specific class of individuals to be subjected to discrimination prohibited by this part may by himself or by a representative file… a written complaint”, and that the complaint “must be filed not later than 180 days from the date of the alleged discrimination”, unless the responsible HHS official extends the time for filing. The 180 days is the practical constraint on look-back: it runs from the discrimination, not from the deadline, so an inaccessible portal generates a fresh window every time someone cannot use it.

The second route needs no complainant at all. Under 80.7(a) the responsible HHS official “shall from time to time review the practices of recipients to determine whether they are complying with this part”. Periodic compliance reviews are initiated by the Department. A practice that has never had a patient complain has not thereby established that it will not be looked at.

What HHS does with a complaint

Under 45 CFR 80.7(c) the responsible official “will make a prompt investigation whenever a compliance review, report, complaint, or any other information indicates a possible failure to comply”. The regulation says what that investigation looks at: “the pertinent practices and policies of the recipient, the circumstances under which the possible noncompliance… occurred, and other factors relevant to a determination”.

Then 80.7(d)(1): if the investigation indicates a failure to comply, HHS informs the recipient and “the matter will be resolved by informal means whenever possible”. Formal action is reached only where informal resolution has been attempted and failed. This is the stage that decides most matters, and it is the stage a practice can prepare for — an investigator asking about the pertinent practices and policies of a recipient is asking for a record, and either one exists or it does not.

What happens if informal resolution fails

45 CFR 80.8(a) sets out the remedy: where noncompliance “cannot be corrected by informal means”, compliance “may be effected by the suspension or termination of or refusal to grant or to continue Federal financial assistance or by any other means authorized by law”. The other means expressly include a reference to the Department of Justice with a recommendation that proceedings be brought, and any applicable proceeding under state or local law.

For a practice covered because it takes Medicare Part B, that is the sentence with teeth in it. But the procedure attached to it is deliberately heavy, and honest advice has to say so. Under 80.8(c), no order suspending or terminating assistance becomes effective until three things have happened: HHS has advised the recipient of its failure and determined that compliance cannot be secured voluntarily; there has been “an express finding on the record, after opportunity for hearing”; and 30 days have elapsed since the Secretary filed a full written report of the circumstances with the House and Senate committees with jurisdiction over the program. The same paragraph limits any such action to the particular recipient found noncompliant and “to the particular program, or part thereof, in which such noncompliance has been so found”. Enforcement by any other means carries its own notice period — at least ten days, under 80.8(d), during which further efforts to persuade the recipient to comply are required.

The realistic reading, then: termination of funding is the authorised endpoint rather than the expected one, and the pressure a practice actually feels comes from the investigation and the informal-resolution stage, which arrive far sooner and cost real money to answer badly.

Retaliating against a complainant is a separate violation

45 CFR 80.7(e) prohibits any recipient or other person from intimidating, threatening, coercing or discriminating against an individual “for the purpose of interfering with any right or privilege” secured by the regulation, “or because he has made a complaint, testified, assisted, or participated in any manner in an investigation, proceeding or hearing”. The same paragraph requires that the identity of complainants be kept confidential except as necessary to carry out the investigation. Worth knowing before a front-desk conversation about an accessibility complaint becomes a second matter on top of the first one.

The provision closest to a safe harbour, and its limits

There is one, and it is narrower than it first reads. 45 CFR 84.89 provides that a recipient not in full compliance with 84.84(b) “will be deemed to have met the requirements… in the limited circumstance in which the recipient can demonstrate that the noncompliance has such a minimal impact on access” that it would not affect a disabled person’s ability to access the same information, engage in the same interactions, conduct the same transactions, or otherwise participate in the same programs — each of those “in a manner that provides substantially equivalent timeliness, privacy, independence, and ease of use”.

Two things follow. First, the burden sits on the recipient: the section says the recipient must demonstrate it, which is an evidentiary task, not an assertion. Second, the four-part equivalence test is where health settings fail even when the information is technically reachable. Privacy and independence are the prongs that bite. A lab result a blind patient can only obtain by having a family member read the screen has been accessed — but not independently, and not privately. A minimal- impact argument that would work for a marketing page can fail on the same defect inside a patient portal, for exactly that reason.

What this means for what you spend before May 2027

HHS priced the requirement in its own regulatory impact analysis at $934.7 million in annualized cost against $1,265.6 million in annualized benefit — a number that describes the sector, not your practice, but which tells you the Department expects real remediation work rather than a paperwork exercise. The extension published on 11 May 2026 deferred cost; it did not remove it.

Because the enforcement route runs through investigation and informal resolution rather than an automatic penalty, the asset that determines a practice’s exposure is the record. What was tested, on what date, against which success criteria, what was found, what was fixed, and what is scheduled. A practice with defects and a dated remediation record is in a materially different position at the informal-resolution stage than a practice with the same defects and nothing written down — and the second one cannot make a minimal-impact argument at all, because 84.89 requires it to demonstrate something.

Where CivicBinder Health fits

The binder is that record. It audits the website, the patient portal and the patient-facing documents against WCAG 2.1 AA, states what was tested and what was found, and gives remediation instructions written for the templates and documents you actually have — dated and attributable, so the work is evidenced rather than asserted.

Flat fees: $299 for a single practice site, $499 covering website, portal and documents, and $19/month for ongoing monitoring. Request a free scan to see where you stand — public surfaces only, no patient data.

For the dates themselves and which surfaces the rule reaches, Section 1557 reaches your patient portal and your documents is the starting point. If the portal is the part you are worried about, which parts of a patient portal are actually in scope works through the vendor question. And if you are pricing the work, what remediation costs and what vendors charge in 2026 cover it from both directions.

The text of 45 CFR 84.89 and 84.98, and of 45 CFR 80.7 and 80.8, was verified on 13 August 2026 against the codified regulation as of the 1 July 2026 edition. The compliance dates and the regulatory impact figures were verified the same day against the published interim final rule (91 FR, doc. 2026-09266), and a Federal Register search confirmed that no later HHS rule has superseded it. Nothing here is legal advice, and a practice facing an actual complaint should have counsel read 45 CFR part 81 as well, which governs the hearing procedure this page only summarises.